saas-readiness

Summary

What the 2026-05-01 audit found between the app and a multi-tenant commercial product. Carried from docs/ROADMAP.md as written.

Built from

• feature-completeness
• roles
• course-as-code

Body

This is an audit dated 2026-05-01, and parts of it have since been done. The first gap, "No Organization / tenant model", was closed by FEAT-0008. Placeholder Privacy and Terms pages now ship; see privacy. The rest was not re-checked, which is why the page is a draft.

Phases 1–5 take the app from clone-to-deployable. Phases 6–9 close the gap to a multi-tenant commercial SaaS. The snapshot below is what the audit found — it motivates the rest of the doc.

Already SaaS-shaped:

• AES-256 encryption for secrets at rest (apps/server/src/shared/encryption/)
• Soft-delete on every major model (packages/db/prisma/schema.prisma)
• JWT + Google/GitHub OAuth + role guards
• SES email with verification/reset templates (apps/server/src/lib/email/)
• Express + GraphQL throttler with tunable buckets
• Vercel deploys wired for both apps
• 04-analytics module (learning analytics — not product analytics)
• OpenTelemetry scaffolded (gated by OTEL_ENABLED, currently unwired)

Load-bearing gaps:

Gap	Closes in
No Organization / tenant model — single global user/course pool	Phase 6
No payments — no Stripe/Razorpay anywhere	Phase 7
No async job queue — course sync runs blocking in resolver	Phase 8
No AuditLog table — DPDP/enterprise blocker	Phase 8
No error tracking — OTel scaffolded but unwired, no Sentry	Deferred — relying on Vercel function logs until scale demands more
No operator admin UI — only a few admin GraphQL mutations exist	Phase 8
User.loginAttempts / lockedUntil / User.language declared but unused	Phase 8 (abuse), deferred (i18n)
No privacy/ToS/cookie consent, no data export, no hard-delete	Phase 9
No marketing surface — no pricing page, robots.txt, sitemap.xml, JSON-LD	Phase 9

Last refresh

2026-05-01 — the audit's own date. Moved here on 2026-10-04 without being re-run; tasks.md T006.

Sources

• (synthesis pages cite wiki pages, not raw files)